Hey everyone. First year as an SRE, and my team's been running Akamai Prolexic for DDoS protection across our main services. I was thrown into the deep end with the pager for it, so I've seen it in action (or, thankfully, *inaction* when it's working).
The verdict after 12 months? Honestly, it's been rock solid for the big network layer floods. We've had a couple of massive volumetric attacks that just... vanished. The traffic graphs go vertical for a second, then Prolexic kicks in and it's a flat line. No latency spikes, no outages. From a pure "keeping the pipes clear" perspective, I sleep a bit easier knowing it's there.
But (and there's always a but, right?) we learned pretty quickly that it wasn't a silver bullet. The layer 7 stuff, the sneaky bad bot traffic that looks almost like real users... that was slipping through and causing us real problems. Our app metrics would show elevated error rates and weird latency, but Prolexic wasn't flagging it as an attack. It was chewing up backend resources and skewing our SLOs 😅.
So about six months in, we ended up adding a separate, specialized bot management solution in front of our main application stack. Now Prolexic handles the big tsunami, and the bot manager deals with the persistent, gnarly tide. The combo works, but it's two systems to monitor and pay for.
Anyone else running a similar setup? I'm curious if other teams just use Prolexic's own bot manager features (I hear they've expanded them) or if a layered approach like ours is common. Still trying to figure out what "best practice" looks like from an observability standpoint when you've got two mitigation points.